The purpose of this repo is to share examples of CI/CD integrations with Snyk.
There are typically 4 ways to deploy Snyk in a CI/CD pipeline:
- Using a native plugin from the marketplace
- Installing Snyk CLI using the npm i -g snyk command in the pipeline (CLI-like)
- Installing the Snyk CLI binary
- Installing the Snyk CLI container image
The various ways are explained in details on the Snyk support page.
Note, you change snyk test to any of the following:
snyk code testto test your source codesnyk container testto test your containersnyk iac testto test your infrastructure as code files
We are continuously trying to update this repo with useful templates.
If you have suggestions for improvement feel free to share them with us!
The CI/CD examples are meant to showcase the Snyk integration and therefore are not complete build pipelines. Applications will not be compiled, tested or packaged unless it is needed to showcase Snyk features.
Snyk has various ways to output results during the CI/CD process.
- Failing the build using a exit code if security vulnerabilities are detected
- Output of HTML reports using
snyk-to-htmland potentially ignoring the return code - Output of SARIF artifacts for Git repositories with integrated CI/CD systems so that pull requests can be decorated (Github, Bitbucket etc..)
Whenever possible, this repository should showcase all possible outputs.
The top level folders resemble the CI/CD system in use, e.g. Github Actions, Azure Pipelines, and can contain sub folders if needed.
For the files themselves, they are meant to be "self-describing" and "self-contained". This means:
- They are named based on the
system,type of installation,language/package managerand optionally classifiers on the output. For example, a fileGitHubActions-npm install-nodeJS.ymldescribes- a Github Actions file
- installation of
snykvianpm install - specific instructions for
nodeJSprojects
- A file named
GitHubActions-npm install-nodeJS-sarif.ymlcould build on the file above but output specific sarif instructions for GH Actions to pick up.
The language/package manager part can be renamed to generic, if no language or package specific instructions are needed!
As the audience for these files are users new to Snyk, the contents of the file need to be concise & helpful. The top of the file should contain helpful links to the documentation of the CI/CD system itself and a note on what the filename in the end should be. In the GH Actions example, the filename really should be .github/workflows/snyk.yml, for example.
Refer to the below table for example values.
| System | Type Of Installation | Language / Package Manager |
|---|---|---|
| AWS CodeBuild | npm install | generic |
| Azure Pipelines | manual | nodeJS |
| Bitbucket | plugin | maven |
| Concourse CI | docker | gradle |
| GitHub Actions | ||
| Jenkins | ||
| Travis CI |
Contributors are welcome! Feel free to raise questions, feature requests or change sets in this Github Repository!
To test your changes, fork the Juice Shop repository and add your changes there. It's a npm based JS repo with a Dockerfile & associated image plus IaC configuration (Kubernetes).